Cyber Risk Assessment

AI made attackersfaster. Has yourdefence kept up?

In October 2026, attackers were reported using AI tools to try passwords at machine speed and to reach hundreds of Microsoft 365 tenants through one IT supplier. We find the doors those tools would try first, rank them by risk, and put a cost on closing each one.

Scope my Attack Surface Check

Simulation · Ridgeline (fictional)

0Sign-in attempts

0Accounts opened

Waiting to start

At about 2,900 attempts a minute, the rate reported in October. A shared mailbox without multi-factor sign-in is all it takes.

What October showed

The attacker no longer needs a team.

2,900+

Attempts a minute

Sign-in attempts run by an AI penetration testing tool in one campaign.

2,250+

Tenants targeted

Microsoft 365 tenants targeted through one IT supplier's stolen app credentials. Huntress saw 300+ accessed.

100+

Websites, one operator

Websites broken into by a single operator using AI agents.

24%

Mid-market companies

US middle-market companies that reported a ransomware attack or demand in the past year.

Sources: Microsoft and Huntress, via SecurityWeek, October 2026; Reuters, October 2026; RSM US Middle Market Business Index, 2026.

What AI changes

Faster, wider, more convincing. The same doors.

Speed

Minutes, not weeks.

AI tools test passwords, known flaws and misconfigured apps around the clock. A gap you planned to fix next quarter can be found tonight.

Scale

Nobody is too small.

One operator can now work hundreds of targets at once. Mid-size companies are no longer skipped for bigger names. They are simply next on the list.

Persuasion

Fakes that read right.

Phishing emails, invoices and voice calls written or cloned by AI no longer carry the spelling mistakes staff were trained to spot.

What AI does not change

The way in is still weak sign-ins, suppliers with too much access, unpatched systems and backups nobody has tested. Close those, and AI-assisted attacks fail the same way ordinary ones do. That is what we assess.

Engagements

Three ways to work with us.

Fixed fee, quoted within 3 business days of seeing the scope. Work starts within 5 business days.

10 business daysStart here

AI Attack Surface Check

For any company that wants to see what an automated attacker would find first.

Everything you have online, mapped and scanned without disruption
Staff passwords already exposed in breach data
Microsoft 365 or Google Workspace sign-in and app review
Which suppliers and apps hold admin access
Top 10 fixes, ranked by risk and costed

Request a fixed quote

4 to 6 weeks

Cyber Risk Assessment

For companies with 50 to 1,000 staff, before a board review, an insurance renewal or a sale.

Everything in the Check
Scored across 8 areas, mapped to NIST CSF 2.0
The likely attack paths to your most important systems
A risk register with owners and a cost to fix each risk
Board summary, live read-out and a 12-month fix plan

Request a fixed quote

Quarterly

Cyber Care

For companies that have completed an assessment.

Quarterly re-scan and re-score against the same model
New exposed passwords and systems flagged as they appear
Your score tracked over time for your board
A short monthly note on incidents relevant to your business

Request a fixed quote

Timings run from the day access is in place. Urgent exposures are reported the day we find them. See the Collate Cyber Risk Model

Cyber Self-Check

How exposed are you?

Ten questions, two minutes. You get a score out of 100, your band and your two weakest areas. Nothing is sent anywhere.

From the Cyber Bulletin

All incidents

Loading the latest incidents

Check my exposure

How we work

Careful by design.

Non-intrusive

Read-only access and scans that do not disrupt your systems, run only with your written authorisation.

Same-day alerts

If we find something an attacker could use now, you hear about it that day.

Costed and ranked

Every finding comes with a cost and effort to fix, ranked by risk.

Certified people

Led by certified security specialists, with Collate reviewing every finding.

Independent

We do not sell security software, monitoring or insurance.

Questions

Asked before every engagement.

Is this a penetration test?

No. A penetration test tries to break in. We assess from the outside and with read-only access, and nothing we do changes your systems. If your risk calls for a penetration test, we scope it and recommend who should run it.

Will this help with our insurance renewal?

Insurers ask about multi-factor sign-in, backups, patching, supplier access and incident plans. Our findings give you accurate answers to those questions before you sign anything. We do not arrange insurance or give insurance advice.

What access do you need?

Written authorisation to scan what you have online, read-only administrator access to Microsoft 365 or Google Workspace, and interviews with your IT lead and, if you have one, your IT provider.

Our IT is outsourced. Is that a problem?

No, it is common. We work alongside your provider, and the access they hold to your systems is one of the things we review.

How long before we see results?

Urgent exposures the same day. The AI Attack Surface Check reports 10 business days after access is in place. The full assessment reads out in week 5 or 6, depending on the size of your environment.

Can you guarantee we will not be breached?

No one can honestly promise that. We show you exactly where you stand, what to fix first and what it will cost.

Get in touch

Clarity before commitment.

Tell us what you are working on. It takes two minutes, and we reply within one business day.

contact@collatenow.com.au

Start with
a brief

Collate. Independent technology advisory.

Collate Pty Ltd · ACN 702 564 823 · Adelaide, South Australia. Collate provides technology assessments and data services. We do not provide legal, tax, financial or investment advice, and we do not advise on the price of any transaction or whether to proceed. Cyber risk assessments are not a guarantee against attack and are not insurance advice.